Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AnalyticRuleValidationTesting #8990

Closed
wants to merge 4 commits into from
Closed

AnalyticRuleValidationTesting #8990

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c2a82b9
AnalyticRuleValidationTesting
v-sudkharat Sep 12, 2023
a3f39f7
Update SpyCloudEnterpriseProtectionMalwareRule.yaml
v-sudkharat Sep 12, 2023
26ed402
Update SpyCloudEnterpriseProtectionMalwareRule.yaml
v-sudkharat Sep 12, 2023
b182081
Update SpyCloudEnterpriseProtectionMalwareRule.yaml
v-sudkharat Sep 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 68 additions & 0 deletions Solutions/testing/SpyCloudEnterpriseProtectionMalwareRule.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
id: 7ba50f9e-2f94-462b-a54b-8642b8c041f5
name: SpyCloud Enterprise Malware Detection
description: |
'This alert creates an incident when an malware record is detected in the SpyCloud watchlist data'
severity: High
requiredDataConnectors: []
status: Available
queryFrequency: 12h
queryPeriod: 12h
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
tactics:
- CredentialAccess
relevantTechniques:
- T1555
query: |
SpyCloudBreachDataWatchlist_CL
| where Severity_s == '25'
| project TimeGenerated, Document_Id_g, Source_Id_s, SpyCloud_Publish_Date_t, Email_s, Domain_s, Password_s, Password_Plaintext_s, Username_s, Infected_Machine_Id_g, Infected_Path_s, Infected_Time_t, Target_Domain_s, Target_SubDomain_s, User_Hostname_s, User_OS_s, Target_URL_s,IP_Address_s
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: 12h
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride: null
entityMappings:
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: Infected_Machine_Id_g
- identifier: DnsDomain
columnName: User_Hostname_s
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: Email_s
- identifier: Name
columnName: Username_s
- entityType: DNS
fieldMappings:
- identifier: DomainName
columnName: Target_Domain_s
- entityType: DNS
fieldMappings:
- identifier: DomainName
columnName: Target_SubDomain_s
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IP_Address_s
customDetails:
Document_Id: Document_Id_g
Password: Password_s
Password_Plaintext: Password_Plaintext_s
Infected_Path: Infected_Path_s
Infected_Time: Infected_Time_t
Domain: Domain_s
Source_Id: Source_Id_s
PublishDate: SpyCloud_Publish_Date_t
User_Host_Name: User_Hostname_s
sentinelEntitiesMappings: null
version: 1.0.0
kind: Scheduled